From 300bbcbf5c58c6256c8f6e76a98e93e5893dcf22 Mon Sep 17 00:00:00 2001 From: Chris Bookholt Date: Wed, 1 Jul 2026 16:50:40 -0700 Subject: [PATCH] git-utils: clarify raw PATH rejection --- codex-rs/git-utils/src/git_command.rs | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/codex-rs/git-utils/src/git_command.rs b/codex-rs/git-utils/src/git_command.rs index 4491959515..7e68c547c4 100644 --- a/codex-rs/git-utils/src/git_command.rs +++ b/codex-rs/git-utils/src/git_command.rs @@ -52,10 +52,10 @@ impl GitRunner { if !directory.is_absolute() { continue; } - // Check the PATH spelling before appending `git`. On Windows, - // PathBuf::push resolves `..` when its base uses a verbatim prefix, - // which would otherwise erase repository traversal before the - // first containment check. + // Check the raw PATH spelling before canonicalization. A search + // directory can traverse through an untrusted repository and + // resolve outside it; checking only the resolved parent or + // candidate would lose that provenance. if search_directory_is_untrusted(&directory, untrusted) { continue; }